Huntress Reports Ransomware Activity Shifts After Qakbot Takedown
Summary
Huntress says ransomware activity shifted after Qakbot’s 2023 takedown, with reported increases in DarkGate, Akira, and LockBit activity from August to September. It also observed more attacks targeting small businesses and MSPs.
Key points
- The FBI-led multinational operation disrupted Qakbot in late August 2023; Huntress says Qakbot re-emerged within months.
- From August to September 2023, Huntress reported activity increases of 880% for DarkGate, 510% for Akira, and 102% for LockBit.
- Huntress observed increased ransomware targeting of small businesses and managed service providers, which attackers may use as entry points to larger networks.
Article Details
- Event Type
- Huntress reported increased ransomware activity and shifts in malware activity following the disruption of Qakbot.
- Impact
- The article reports increases in ransomware activity targeting small businesses and managed service providers (MSPs), which attackers may exploit as entry points to larger networks. From August to September 2023, Huntress observed activity increases of 880% for DarkGate, 510% for Akira, and 102% for LockBit. Qakbot re-emerged within months of the multinational operation that disrupted it.
Malware
AkiraAkira spiked by 510% DarkGateDarkGate jumped by 880% Emotetvariants remain relatively unchanged, their emergence is a strong signal that, like the reappearance of Emotet in similar circumstances, threat actors will attempt to capitalize on existing knowledge and investmentLockBitLockBit increased by 102% QakbotA Snapshot of Ransomware Post-Qakbot
Vendors
Industries
Critical infrastructureupon its victims, which ranged from financial institutions to medical device manufacturers to critical infrastructure. But in late-August 2023, the FBI spearheaded a multinational operation that brought down Qakbot,Financial institutionsmalware distribution and control network—had wreaked havoc upon its victims, which ranged from financial institutions to medical device manufacturers to critical infrastructure. But in late-August 2023, the FBIHealthcarein adversarial tactics, with hackers exploiting trusted tools and targeting critical industries like healthcare.